CVE-2026-87821

Lara Dashboard through version 1.3.1 contains a server-side request forgery (CWE-918) in the POST /api/admin/builder/markdown/fetch endpoint, which fetches client-supplied URLs with no validation of the target host and no restrictions on redirects. Any authenticated user can trigger the flaw by posting a malicious URL, causing the server to make an HTTP request to an attacker-chosen destination and return the response body to the attacker. This allows the attacker to read internal HTTP services reachable from the server and, in cloud deployments, to retrieve instance metadata including IAM credentials, potentially enabling further compromise of the cloud environment. Anyone running Lara Dashboard 1.3.1 or earlier where authenticated users can reach the affected API endpoint is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and there are no confirmed reports of in-the-wild exploitation.

What to do: Upgrade to a Lara Dashboard release newer than 1.3.1 as soon as the vendor publishes a patched version (no fixed version is specified in this data) and verify your build includes the fix. As interim mitigation, restrict access to POST /api/admin/builder/markdown/fetch and add egress controls on the server — such as an allowlist for outbound fetch targets, blocking of link-local/instance-metadata addresses (e.g., 169.254.169.254) and internal private ranges, and limits on redirect following — especially for deployments running in cloud environments with metadata credentials. Review logs for authenticated requests to this endpoint that fetched unexpected internal or metadata URLs, and rotate cloud IAM credentials if suspicious fetches are found.